r/CarTalkUK • u/UpsetKoalaBear • 14d ago
News The DfT is letting carmakers decide who's allowed to fix your car
Hello all, I am trying to raise awareness on a relatively recent issue that is going to affect pretty much all cars soon unless more people raise concerns.
Back in 2021, the EU created SERMI. SERMI is an accreditation scheme that allows independent garages to access security related features on cars without having to apply to every manufacturer separately. This can be for things like key programming, immobilisers or programming.
We did not keep it after Brexit and decided not to create our own version. A voluntary GB SERMI scheme launched on 1 April this year, and major manufacturers have signed up, but nothing legally requires it.
On the 29th of September, the DfT closed consultations for its new GB Type Approval regulations. These regulations dictate the requirements for a car to be sold in the UK.
The DfT wants to align with the EU's latest update, which allows manufacturers to apply cybersecurity protections to diagnostic access.
The DfT plans to copy it, including a new section on the conditions for independent repairers to access the OBD port, but with the SERMI parts SPECIFICALLY stripped out.
The bodies the DfT lists as consulted include the SMMT, caravan and towing groups, and two independent trade associations, but no motorists' or consumer organisations.
On who gets access to security data, the DfT says that in GB "it is for manufacturers to decide".
That is damning for the future of car ownership, and if we do not speak up it will not be fixed.
The IAAF is pushing for SERMI to be included with the new GB Type Approval standards.
The consultation closed on 29 September, but the DfT says it will publish its response within three months and then lay the regulations.
If access to security systems is left to manufacturers, more jobs could become dealer only (hidden behind a vague “cybersecurity” angle) especially for people buying secondhand cars in 10-20 years. Cybersecurity is a concern, but that is literally why SERMI exists.
If dealerships are the only ones allowed to repair cars, and if a repair costs more than the car is worth, the "fix" becomes a sales tactic to get someone to buy a new one.
Likewise, expect insurance prices to increase as more cars get written off due to dealership repair quotes.
This is not like iPhones locking down battery replacements or whatever. A car is one of the biggest things most of us will ever buy. For a lot of people, the way they keep that affordable is with an independent garage or fixing it themselves.
I would not want my car's maintenance to be at the whim of a dealership, and I presume the same goes for most of you.
- Write to your MP and ask them to ask the Roads Minister whether SERMI will be made a legal requirement in GB, as it is in the EU and NI, before the regulations are laid.
- If you've been told "dealership only" for a job an independent used to do, or you run an independent garage which has been blocked due to security gateways, please share it.
47
u/NotSayingAliensBut 14d ago
Louis Rossman on YouTube is the 'right to repair' guy and has something like 2.4 million subscribers. He's in the USA but would still probably be interested in airing this in a vid, if you dropped him a line. He is very sharp and well worth having as an ally.
17
6
u/Holiday-Raspberry-26 14d ago
You of course are offering the right answer. This is exactly what Rossman wants to do with his life. I hope the OP sees this.
13
u/Living_Glass_2382 14d ago
Yeah, this seems pretty crucial. Won't pretend I know the ins and outs but right of repair should be a thing we enforce on manufacturers
29
u/Brimwozere 14d ago
Yet another reason not to buy a new car. This one doesn't matter though, they lost me years ago.
11
u/UpsetKoalaBear 14d ago edited 14d ago
Even if that’s the case, it shouldn’t have to be this way and complacency like this is what they bank on people doing.
Secure Gateways become pretty much commonplace after 2018. So most cars since then are affected.
There’s that old saying “plant seeds you won’t see grow” or some shit.
There will be people starting to drive in the next 10+ years who will only ever know new cars or only be able to buy new cars and never be able to repair them.
I’d still recommend contacting your MP, if you can.
4
u/Brimwozere 14d ago
I completely agree, except MPs won't do anything. Just don't buy the new cars. I will then shoot my own comment down by expecting them to make everything else illegal. It's depressing.
3
u/UpsetKoalaBear 14d ago edited 14d ago
If MP’s didn’t do anything, there would not be so many MP’s still in office after multiple elections likewise there would not be so much advice on talking to an MP about issues.
It was the response of several MP’s to constituents who pressured the Post Office into finally commissioning an independent investigation into the Horizon Scandal (Alan Bates was important for that investigation, and had campaigned for a decade, but it was MP’s being asked by their constituents that helped start it).
Likewise it was constituents raising issues with the tampon tax that got it ended.
Especially if you live in a marginal constituency, there is definitely a lot more potential in speaking to your MP than you’d think.
My MP has forwarded my request to the Roads Minister to ask for an explanation into why SERMI was removed from the type approval consultation and whether the DfT considered the ramifications.
8
u/Brimwozere 14d ago
Mps have Screwed my life up multiple times over the years. Tried judicial reviews, let alone talking to them. Change has to be a tsunami of public opinion threatening their position. I admire your optimism though. :-)
0
u/Happytallperson 12d ago
Unless you give up driving (which is fine and frankly many city dwellers would be financially better off doing), you will eventually need a car newer than 2018.
Your petrol car will become unviable as the fuel market retracts under the weight of EVs.
1
u/Brimwozere 12d ago
I don't want an EV but I don't object to EVs per se, I object to all the nonsense that modern cars have. The lack of maintability, spying, car knows best etc. I will resist this to the best of my ability.
10
8
u/Federal-Ant-2159 14d ago
I'm a home car tinkerer and things like this boil my piss. Yes I drive older cars to avoid it but it's coming for us all eventually.
I personally hate AI but if some good can come from it, pointing it at these systems and cracking them wide open is the best defense I can think of. Then watch as it's labelled illegal dangerous hacking.
3
u/daisymayfryup 14d ago
I wonder what the score is with this in Northern Ireland? My motors are both ICE and that's the way it'll be for the foreseeable for me but I'll hit my MP up anyway because this is another step on the road to owning nothing and being over the moon about it.
2
u/UpsetKoalaBear 14d ago
They still get SERMI. This only affects GB unfortunately.
1
u/ComprehensiveTap911 14d ago
How will manufacturers deal with that?
A car sold in NI but then used in agab or vice versa if it's connected to disabled servers?
I would imagine that servers would have to be kept running to be able to switch the car between regions?
2
u/UpsetKoalaBear 14d ago
The way SERMI works, you need to be an approved independent mechanic with a registered business to get access to the tools that allow you to get through the secure gateway.
If you are a GB-based independent garage/mechanic, they can just arbitrarily remove your access based on the address of your business.
Likewise SERMI still doesn’t make manufacturers keep their servers running. SERMI controls who gets access. So if they turn their servers off, NI still has the same issues.
3
u/fuckpig2020 14d ago
Thank fuck I'm poor and can't afford this shit. The old merc will waft me about in 90s luxury, but it will do as it's told and keep sthum
2
u/carguy143 14d ago
I highly doubt car makers would change much between cars sold in the UK and the EU as we're too small a market.
They already do the bare minimum to make their cars right hand drive. For example, smaller Renaults and Peugeots had wipers that swept to the left, leaving large parts of the upper right of the windscreen unswept (not good for taller drivers). Renault, again, and Nissan, the keyhole is in the left hand door, not the right. Good luck if your battery dies and you need to access the car. Renault, again, the power or start button is on the left hand side in right hand drive cars, away from the driver. Finally, the case of the citroen with mysterious dual controls: they left the original brake controls on the left and if a passenger stretched out hard enough, they could apply the brakes.
Then of course the mandatory speed limit stuff in the EU, the car markers forced it on UK drivers despite it not being law here.
2
u/UpsetKoalaBear 14d ago
The way SERMI works, you need to be an approved independent mechanic with a registered business to get access to the tools that allow you to get through the secure gateway.
If you are a GB-based independent garage/mechanic, they can just arbitrarily remove your access based on the address of your business.
Which is what makes it frustrating because our cars are mostly built to EU spec anyway, the security systems SERMI works with are already in them.
It’s entirely a software based lockout.
2
u/InexplicableBadger 13d ago
One of the big issues is the connectivity new cars have, but along side that the total lack of functional computer security. From a software point of view, the ability to lock down who can actually talk to the onboard systems is a basic security requirement that car manufacturers have completely neglected to think about and there are regular threads about hacking the CAN bus to steal the car.
On the other hand, you as the owner should have the password to your own car and should be able to hand it out as you see fit.
1
u/karl-rupecht-kroenen 13d ago
You need to use the Bosch system that’s what we use for security access, and OSCA for reprogramming light headlights and stuff.
0
u/Burnsy2023 14d ago
So would aligning with the EU solve this issue?
2
u/UpsetKoalaBear 14d ago
Yes. Instead we are aligning half the way by specifically excluding SERMI.
Likewise, though this is a tangent, SERMI only solves the ability to bypass the secure gateway with approval. It does not solve the problem of a manufacturer turning off the servers used to authenticate access.
51
u/UpsetKoalaBear 14d ago edited 14d ago
I’d also add that vehicles were exempted from the smart devices law which required companies to tell customers how long software support should last in February 2025.
So there is now no law which requires carmakers to keep running the servers needed to repair their cars, or to release the means to repair them when they stop.
This effectively will make cars releasing now untouchable in the future when they go into the secondhand market. Once those servers go, some repairs may become impossible for anyone, dealer or independent.
Stellantis recently moved from a single secure gateway to multiple secure gateways for every module. Meaning it will be impossible to repair those cars in the future unless the servers stay up. It’s only a matter of time before it is the same for every car as there is now nothing stopping them.
We are slowly seeing the erosion of the secondhand market and the push for subscription based car models. With EV and parts commonality, this is only going to be ever easier.